58 per cent of Germany’s electricity demand was already covered by renewable energies in the first half of 2024. The solar industry in particular is booming, with the 2024 expansion target already reached in mid-May. Interest in battery storage is also greater than ever before. However, the more projects and the more players in the market, the more valuable the land that is suitable for renewable energy plants or storage projects.

In order to get in touch with the owners of potential sites, project developers often request owner data from the relevant land registry offices that maintain the property registers. Whilst no more than a legitimate interest in the enquiry is required, the data received must be handled with care.

When should the GDPR be observed?

The GDPR and its data protection requirements must always be taken into account when retrieving and using owner data from property registers. Such activities are referred to as “processing” in the GDPR. Owner data constitutes personal data within the meaning of the GDPR without exception, and its processing by the project developer opens up the scope of application of the GDPR for the project developer.

When collecting owner data, data protection requirements are already partially considered by requiring the land registry to demonstrate a “legitimate interest”. As can be seen from the legal justifications of the state laws on land surveying and the land register, the “legitimate interest” has always been intended as a threshold for access to personal data in the form of owner data. This was not fundamentally changed with the introduction of the GDPR in 2018.

If a legitimate interest is assumed by the land registry, this is an indication of the lawfulness of the processing of the owner data from a GDPR perspective. However, it is the subsequent specific handling of the owner data - from analysing which owners should be contacted to the actual sending of enquiries/advertising letters to the owners - that determines the lawfulness of the processing by the project developer.

What specifically do project developers need to consider from a GDPR perspective?

As the owners have generally not given the project developer consent to the processing of their owner data under data protection law (they generally do not know the project developer), Article 6 (1) (f) GDPR remains the legal basis. Article 6 (1) (f) GDPR requires that the legitimate interests of the project developers and owners in the planned processing - i.e. to what extent data is collected, in what form the data is analysed, how long the data is stored, how contact is specifically made with the owner, etc. - are weighed up against each other. The result of this consideration must be documented by the project developer. The basic prerequisite and first step in any case is that the project developer has drawn up a concrete process for how owner data is to be handled.

In addition, the owners must be informed about the processing of their data by the project developers, meaning that they must be provided with so-called data protection notices within the meaning of Articles 13 and 14 GDPR.

Finally, if the scope of the owner data collected is very large, it must be checked whether a data protection impact assessment in accordance with Article 35 GDPR is required. As a rule, this will not be the case, but there may be exceptions.

As the volume of owner data in the context of project development is often large, proper handling of personal data should always be ensured. Non-compliance with the GDPR can result in considerable fines (up to EUR 20,000,000 or 4% of group turnover).

Why compliance with GDPR requirements is becoming increasingly important in practice

Recently, however, compliance with the GDPR requirements has also become increasingly important from an economic point of view. This is because the land registry offices have started to increase the requirements for project developers to demonstrate a “legitimate interest” in the owner data. The background to this is twofold: On the one hand, court rulings which demand stricter requirements for the demonstration, at least when large amounts of owner data are requested. On the other hand, more and more owners seem to have complained, as the advertising addressed to them regarding their properties has increased significantly in recent years.

While it used to be sufficient to state the construction of a solar park as a legitimate interest in an abstract sense, it is now often required to specify why the requested large amount of owner data is needed and to what extent data protection-compliant processing is ensured.

Outlook

Energy projects need land. The fact that project developers in the renewable energy and storage sector are therefore allowed to access owner data in most cases is confirmed by case law and official practice.

However, to ensure that the procedure for acquiring land does not become a deal-breaker against the background of increased requirements for obtaining owner data and the risk of GDPR fines, GDPR-compliant handling of owner data should be standard practice. Correct data protection notices can also prevent owners contacted through personal enquiries/letter advertising from reacting negatively to the approach made by developers from the outset.